Securing the Human a Full-Time Commitment

Encouraging the people in your organization to make safer cyber decisions requires dedicated brainpower to pull off, SANS study shows.

While most enterprises today boast at least some sort of security awareness training program, the fruits of those labors are a mixed bag. In fact, when measured on a five-tier security awareness maturity model, only about 10% of organizations can boast the highest two tiers of maturity, according to a study out from SANS Institute today.

The study's findings show that a lot of the varied success has to do with one simple and unavoidable factor - staffers dedicated to training efforts.

It may seem like a no-brainer, but the truth is that many organizations today are stuck with subpar security awareness training because they are simply tacking duties around the organization and implementation of an awareness program onto existing security staffers' job descriptions.

"If you've got somebody that's spending only 10%, 15%, or 20% of their time dedicated to awareness, you're just checking the box," says Lance Spitzner, director of SANS Securing the Human program, who helped spearhead the 2017 Security Awareness Report.

In its third year running, the report questioned over 1,000 security awareness professionals worldwide about the state of their awareness training programs at their organizations. The survey showed that about half of organizations are in the middle stage of program maturity - promoting awareness and behavior change - while over 27% are still stuck in compliance focus.

Only about 7.6% of organizations say their program is nonexistent, although selection bias may have played a part in this low number, given the type of participants chosen for this study. According to the 2016 Dark Reading Strategic Security Survey, only 56% of participants reported that their organization provided end-user awareness training. A different survey from ESET out earlier this month shows that one in three employees do not receive any form of cybersecurity training at their organization and one in five employee respondents said they are "not at all" aware of cyber security best practices.

Meanwhile, the organizations really making a dent with their existing security programs are rare indeed. SANS found that about 9.8% of organizations had reached the maturity of long-term sustainment and culture change. Meanwhile, just .85% of organizations have gotten to the point where they've got a metrics framework that can tie awareness training to security readiness.

The SANS report took a look at the top two categories of performance and found that one of the biggest factors correlated to success was full-time employee commitment. The report found that the minimum level of staffing for a program to change behavior at an organizational level was 1.4 full-time employees. Meanwhile, the most successful programs had at least 2.6 full-time employees dedicated to awareness.

According to Spitzner, the number of people dedicated to the program trumped even overall budget as a success factor.

"Awareness programs are all about collaboration, communication, and partnerships, and that takes time," he explains. "Some of the most effective awareness programs are high impact, but low budget, because they're using existing resources, ambassador programs, champion programs and even existing graphic design capabilities."

As a result, Spitzner says the number one recommendation coming out of the report is for organizations to heavily funnel awareness dollars to human resources than to fancy technology.

"I don't want to say that to be successful you can't use external resources or buy things. What I'm saying is awareness is not just about buying a big flashy box," he says. "It doesn't have to cost a lot of money. [The team] just needs time to put it together."

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading. View Full Bio

Cybersecurity professionals are in high demand -- and short supply. Find out what Dark Reading discovered during their 2017 Security Staffing Survey and get some strategies for getting through the drought. Download the report today!

An exploitable command injection vulnerability exists in the measurementBitrateExec functionality of Sony IPELA E Series Network Camera G5 firmware 1.87.00. A specially crafted GET request can cause arbitrary commands to be executed. An attacker can send an HTTP request to trigger this vulnerability...

In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and line feed characters from the header value. This allow unfiltered values to inject a new header in the client request or server response.

In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or IBM JVM on the same machine and use Attach API operations, which includes the ability to execute untrusted native code. Attach API is enabled by default on Windows,...

Systems with microprocessors utilizing speculative execution and Intel software guard extensions (Intel SGX) may allow unauthorized disclosure of information residing in the L1 data cache from an enclave to an attacker with local user access via a side-channel analysis.